Main Archive Page > Month Archives  > full-disclosure-uk archives

Re: [Full-disclosure] noise about full-width encoding bypass?

From: ascii <ascii_at_nospam>
Date: Mon May 21 2007 - 21:01:26 GMT
To: Brian Eaton <eaton.lists@gmail.com>

Brian Eaton wrote:
> To summarize what I've heard from various sources: I am missing
> something important. =) Both PHP and ASP.NET will decode these
> characters into their ASCII equivalents.

(AFAIK) Only ASP.NET/IIS decodes that automatically.

PHP *can* do that as like JSP and probably others but that has to happen explicitly in the application code or on an other layer.

Regards,
Francesco `ascii` Ongaro
http://www.ush.it/

---

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/